NEBOSH International Diploma in
NEBOSH International Diploma in
Occupational Health and Safety
Occupational Health and Safety
Please be advised that the course material is regularly reviewed and updated on the eLearning platform. Please be advised that the course material is regularly reviewed and updated on the eLearning platform. SHEilds woul
SHEilds would like to inform students downloading these printable notes and using these from which tod like to inform students downloading these printable notes and using these from which to study that we cannot ensure the accuracy subsequent to the date of printing. It is therefore important to study that we cannot ensure the accuracy subsequent to the date of printing. It is therefore important to access the eLearning environment regularly to ensure we can track your progress and to ensure you have access the eLearning environment regularly to ensure we can track your progress and to ensure you have the most up to date materials.
the most up to date materials. Version 1.3b (25/11/2013) Version 1.3b (25/11/2013)
Element - IC4: Storage,
Element - IC4: Storage, Handling & Processing of Handling & Processing of Dangerous SubstanceDangerous Substances.s. Learning
Learning outcomes.outcomes.
On completion of this element, candidates should be able On completion of this element, candidates should be able to:to:
1. Outline
1. Outline the main physical and the main physical and chemical characteristics of industrial chemical processes.chemical characteristics of industrial chemical processes. 2.
2. Outline the Outline the main principlmain principles of es of the safe the safe storage, handling and storage, handling and transport of transport of dangerousdangerous substances.
substances. 3.
3. Outline the maiOutline the main principles n principles of the desiof the design and use ogn and use of electrical f electrical systems and esystems and equipment inquipment in adverse or hazardous environments.
adverse or hazardous environments. 4.
4. Explain the Explain the need for need for emergency plemergency planning and the anning and the typical organisational typical organisational arrangements neededarrangements needed for emergencies.
for emergencies. Relevant
Relevant StandardStandard::
United Nations, Recommendations on the Transport of Dangerous Goods: Model Regulations,United Nations, Recommendations on the Transport of Dangerous Goods: Model Regulations,
14
14ththedition, UN Publications, 2005. ISBN: 9211391067.edition, UN Publications, 2005. ISBN: 9211391067.
International Labour Office,International Labour Office, SafetySafety in the Use of Chemicals at Work, anin the Use of Chemicals at Work, an ILOILO Code of PracticeCode of Practice,,
ILO, 1993. ISBN: 9221080064. ILO, 1993. ISBN: 9221080064. Minimum hours of tuition 7 ho
Minimum hours of tuition 7 hours.urs.
1.0 - Main
1.0 - Main Physical & Chemical Characteristics of Industrial Chemical Processes.Physical & Chemical Characteristics of Industrial Chemical Processes. In chemical reactions, the process will undoubtedly involve a change of energy. The rate of the In chemical reactions, the process will undoubtedly involve a change of energy. The rate of the change of energy in many ways relies on the temperature. As a rough guide, 10°C is enough to change of energy in many ways relies on the temperature. As a rough guide, 10°C is enough to double the rate of the reaction.
double the rate of the reaction.
High pressure contained within systems is also another factor which relates to the accident. The High pressure contained within systems is also another factor which relates to the accident. The build-up of pressure within the walls of tankers and containers must be considered, preferably at the design up of pressure within the walls of tankers and containers must be considered, preferably at the design stage. Pressure release valves are a way of helping to keep the pressure to its operational best, but stage. Pressure release valves are a way of helping to keep the pressure to its operational best, but consideration must be given to the release of vapour built up in the vessel/tank i.e. not to be released consideration must be given to the release of vapour built up in the vessel/tank i.e. not to be released in to the atmosphere.
in to the atmosphere.
A catalyst as applied in this instance can be
A catalyst as applied in this instance can be defined as:defined as:
"Something that makes a chemical reaction happen more quickly without itself being changed." "Something that makes a chemical reaction happen more quickly without itself being changed." This 'something' can be any agent, in either a small or large quantity, which - when added to the This 'something' can be any agent, in either a small or large quantity, which - when added to the reaction - will cause the reaction to strengthen.
reaction - will cause the reaction to strengthen.
1.1 -
1.1 - Endothermic, exothermic and runaway reactions.Endothermic, exothermic and runaway reactions.
In Chemistry, an endothermic reaction is one in which the reactants have less energy than the In Chemistry, an endothermic reaction is one in which the reactants have less energy than the products, and thus a net input of energy, usually in the form of heat, is required. Endothermic products, and thus a net input of energy, usually in the form of heat, is required. Endothermic
reactions are often described as reactions that "feel cold", and contrast with exothermic reactions in reactions are often described as reactions that "feel cold", and contrast with exothermic reactions in
Element - IC4: Storage,
Element - IC4: Storage, Handling & Processing of Handling & Processing of Dangerous SubstanceDangerous Substances.s. Learning
Learning outcomes.outcomes.
On completion of this element, candidates should be able On completion of this element, candidates should be able to:to:
1. Outline
1. Outline the main physical and the main physical and chemical characteristics of industrial chemical processes.chemical characteristics of industrial chemical processes. 2.
2. Outline the Outline the main principlmain principles of es of the safe the safe storage, handling and storage, handling and transport of transport of dangerousdangerous substances.
substances. 3.
3. Outline the maiOutline the main principles n principles of the desiof the design and use ogn and use of electrical f electrical systems and esystems and equipment inquipment in adverse or hazardous environments.
adverse or hazardous environments. 4.
4. Explain the Explain the need for need for emergency plemergency planning and the anning and the typical organisational typical organisational arrangements neededarrangements needed for emergencies.
for emergencies. Relevant
Relevant StandardStandard::
United Nations, Recommendations on the Transport of Dangerous Goods: Model Regulations,United Nations, Recommendations on the Transport of Dangerous Goods: Model Regulations,
14
14ththedition, UN Publications, 2005. ISBN: 9211391067.edition, UN Publications, 2005. ISBN: 9211391067.
International Labour Office,International Labour Office, SafetySafety in the Use of Chemicals at Work, anin the Use of Chemicals at Work, an ILOILO Code of PracticeCode of Practice,,
ILO, 1993. ISBN: 9221080064. ILO, 1993. ISBN: 9221080064. Minimum hours of tuition 7 ho
Minimum hours of tuition 7 hours.urs.
1.0 - Main
1.0 - Main Physical & Chemical Characteristics of Industrial Chemical Processes.Physical & Chemical Characteristics of Industrial Chemical Processes. In chemical reactions, the process will undoubtedly involve a change of energy. The rate of the In chemical reactions, the process will undoubtedly involve a change of energy. The rate of the change of energy in many ways relies on the temperature. As a rough guide, 10°C is enough to change of energy in many ways relies on the temperature. As a rough guide, 10°C is enough to double the rate of the reaction.
double the rate of the reaction.
High pressure contained within systems is also another factor which relates to the accident. The High pressure contained within systems is also another factor which relates to the accident. The build-up of pressure within the walls of tankers and containers must be considered, preferably at the design up of pressure within the walls of tankers and containers must be considered, preferably at the design stage. Pressure release valves are a way of helping to keep the pressure to its operational best, but stage. Pressure release valves are a way of helping to keep the pressure to its operational best, but consideration must be given to the release of vapour built up in the vessel/tank i.e. not to be released consideration must be given to the release of vapour built up in the vessel/tank i.e. not to be released in to the atmosphere.
in to the atmosphere.
A catalyst as applied in this instance can be
A catalyst as applied in this instance can be defined as:defined as:
"Something that makes a chemical reaction happen more quickly without itself being changed." "Something that makes a chemical reaction happen more quickly without itself being changed." This 'something' can be any agent, in either a small or large quantity, which - when added to the This 'something' can be any agent, in either a small or large quantity, which - when added to the reaction - will cause the reaction to strengthen.
reaction - will cause the reaction to strengthen.
1.1 -
1.1 - Endothermic, exothermic and runaway reactions.Endothermic, exothermic and runaway reactions.
In Chemistry, an endothermic reaction is one in which the reactants have less energy than the In Chemistry, an endothermic reaction is one in which the reactants have less energy than the products, and thus a net input of energy, usually in the form of heat, is required. Endothermic products, and thus a net input of energy, usually in the form of heat, is required. Endothermic
reactions are often described as reactions that "feel cold", and contrast with exothermic reactions in reactions are often described as reactions that "feel cold", and contrast with exothermic reactions in
which heat is released. which heat is released.
Although the process of bond-break
Although the process of bond-breaking amongst reactants in a chemical process requires an initialing amongst reactants in a chemical process requires an initial input of energy (the activation energy), in the case of an endothermic reaction, the energy released input of energy (the activation energy), in the case of an endothermic reaction, the energy released when bonds are formed to create reactants is less than that required to break the bonds in the when bonds are formed to create reactants is less than that required to break the bonds in the
products; bonding electrons in the products are therefore at a higher energy than the reactants. Heat products; bonding electrons in the products are therefore at a higher energy than the reactants. Heat energy from t
energy from the material surrounding the reactants is usually what breaks their bonds, so as heathe material surrounding the reactants is usually what breaks their bonds, so as heat energy is transferred from the surroundings to the reactants, the surroundings get colder.
energy is transferred from the surroundings to the reactants, the surroundings get colder. This is often summarised in a chemical equation as follows:
This is often summarised in a chemical equation as follows: Reactants + Energy → Products
Reactants + Energy → Products
Figure 1. Exothermic Reaction. Figure 1. Exothermic Reaction.
Figure 2.
Figure 2. Endothermic ReactionEndothermic Reaction..
1.2 -
1.2 - Examples of endothermic processes.Examples of endothermic processes.
Examples of endothermic processes: Examples of endothermic processes:
Melting ice cubes.Melting ice cubes.
Melting solid salts.Melting solid salts.
Evaporating liquid water. Evaporating liquid water.
Making an anhydrous salt from a hydrate.
Forming a cation from an atom in the gas phase. Splitting a gas molecule.
Separating ion pairs. Cooking an egg. Baking bread.
Examples of endothermic reactions:
Reactions within food when cooking. Respiration reaction.
The polymerisation of ethene to polythene. The reduction of silver ions to silver.
Electrolysis - energy is provided in the form of electricity.
The mixing of barium hydroxide and ammonium thiocyanate causes a powerful endothermic
reaction that causes the products to become so cold that the moisture from the air forms a layer of frost on the outer surface of the beaker.
Reactions in an aqueous solution, where heat energy is transferred from the water to the
reactants. In this way, the temperature of the solution falls.
1.3. - Examples of exothermic processes.
Freezing water.
Solidifying solid salts. Condensing water vapour.
Making a hydrate from an anhydrous salt.
Forming an anion from an atom in the gas phase. Annihilation of matter E=mc2.
Splitting of an atom.
1.4 - Thermal runaway.
An exothermic reaction can lead to thermal runaway, which begins when the heat produced by the reaction exceeds the heat removed. The surplus heat raises the temperature of the reaction mass, which causes the rate of reaction to increase. This in turn accelerates the rate of heat production. An approximate rule of thumb suggests that reaction rate and hence the rate of heat generation
-doubles with every 10°C rise in temperature.
Thermal runaway can occur because, as the temperature increases, the rate at which heat is removed increases in a linear fashion but the rate at which heat is produced increases exponentially. Once control of the reaction is lost, temperature can rise rapidly, leaving little time for correction. The
reaction vessel may be at risk from over-pressurisation due to violent boiling or rapid gas generation. The elevated temperatures may initiate secondary, more hazardous runaways or decompositions.
1.5 - Effects of thermal runaway.
A runaway exothermic reaction can have a range of results, from the boiling over of the reaction mass to large increases in temperature and pressure that lead to an explosion. Such violence can cause
blast and missile damage. If flammable materials are released, fire or a secondary explosion may result. Hot liquors and toxic materials may contaminate the workplace or generate a toxic cloud that may spread off-site.
There can be serious risk of injuries, even death, to plant operators, and the general public and the local environment may be harmed. At best, a runaway causes loss and disruption of production. At worst, it has the potential for a major accident, as the incidents at Seveso and Bhopal have shown.
1.6 - Effect of scale.
The scale on which you carry out a reaction can have a significant effect on the likelihood of runaway. The heat produced increases with the volume of the reaction mixture, whereas the heat removed depends on the surface area available for heat transfer. As scale and the ratio of volume to surface area increase, cooling may become inadequate. This has important implications for scale-up of
processes from the laboratory to production. You should also consider it when modifying a process to increase the reaction quantities.
1.7 - Causes of incidents.
An analysis of thermal runaways in the UK has indicated that incidents occur because of:
Inadequate understanding of the processes of chemistry and thermochemistry. Inadequate design for heat removal.
Inadequate control systems and safety systems.
Inadequate operational procedures, including training.
1.8 - Methods of control of temperature and pressure.
The following HSE leaflet gives good information which is li nked to the control of temperature and pressure:
Introduction.
In the chemical industry there has been a number of major incidents in which loss of containment of a hazardous substances could not be isolated quickly enough. Installations which can cause this major type of incident should have emergency arrangements for the safe and effective shutdown of plant and equipment in a controlled manner.
This information sheet considers the general principles of isolation of hazardous inventories to prevent or minimise loss of containment. It is aimed at designers and manager of chemical manufacturing and onshore oil processing operations. The advice given here in relevant when considering preventive and mitigation measures, mainly at a process plant, but also at storage tanks and long pipe runs
containing hazardous substances and where there is potential to cause a major accident. It does not give detailed guidance on preventive measures for process control, pressure relief arrangements, or emergency shutdown systems in general.
Measures taken to isolate inventories are part of a whole range of means available to manufacturers to ensure that they can take appropriate action in an emergency. Sites may well have different
Risk assessment.
Emergency isolation arrangements are not only needed at those sites subject to specify major hazards legislation. All operations of chemical plant capable of causing a major accident must carry out a risk assessment as required by the Management of Health and Safety at Work Regulations 1992. you must be able to demonstrate that you have adequate arrangements for preventing a major accident and for limiting the consequences of those which do occur. These include the means to stop or substantially reduce release rates by psychically isolating large inventories of hazardous
substances.
Manufactures should be able to demonstrate that they have considered a hierarchy of measures. ie inherent safety followed by measures to prevent, control and minimise the consequences of loss of containment incidents.
Inherit safety and safe operation.
Any active safety shutdown system or procedure should not be used to rectify or mitigate a potentially hazardous situation brought about by poor plant design. A major objective in the design of any plant should be to make the plants integrity safe, as far as possible by designing out the hazards, so reducing reliance on protective systems. At the initial design stage manufacturers should actively consider using, for example.
A safer and/or simpler process. Less hazardous materials.
Reduced pressures and temperatures. Reduced inventories.
It is also important that such matters are reviewed regularly during the plants life, particularly if there is any change, for example introducing a new process or manufacturing system.
Risks arising from the site operations should be controlled by good design and plant integrity and effective safety management systems. However, even following these principles, there may still be situations whee loss of containment of a dangerous substance could cause a major accident. Emergencies may be dealt with in a number of ways. The most appropriate measures should be determined by risk assessments.
Emergency shutdown arrangements.
Emergency shutdown arrangements should provide protection against those potentially hazardous conditions remaining in the final plant deisgn and be considered as part of the formal process hazard review.
The action of an emergency shutdown system should be to bring the plant to a safe state. You could do this by:
Closing valves.
Removing power from motors etc.
or it may be more complex involving:
The venting of process systems simultaneously or in a predetermined sequence. Providing pressure, cooling systems. purging etc.
All of these options will depend on the nature of the processes and foreseeable plant conditions. Isolation of hazardous inventories.
in an emergency, rapid isolation of vessels or process plant is one of the most effective means of preventing loss of containment or limiting its size. The extent of isolation provision should be designed to ensure a safe process state and minimise loss of containment. Emergency isolation facilities and procedures for all significant inventories should be included in emergency plans. Giving information and training to operations and maintenance staff is important. Site personal should know the contents of the plan, included specific action they should take in an emergency.
Systems for achieving emergency shutdown are given here. The range is not exhaustive. Manually operated valves.
Manual valve isolation may be acceptable in some cases where more rapid emergency isolation is not necessary for preventing a major accident. Manually operation valves should be readily accessible and clearly marked, consideration the difficult and confusing circumstances in which emergency
shutdown will probably take place. You should not use them in situations where the operator effecting the isolation would be placed in any danger. This will be a major factor in deciding when to use
remotely operated shut-off valves (ROSOVs).
However , manual valves will often have been fitted mainly for maintenance work and might not provide the safest or most effective way of achieving emergency isolation. Any mitigation function need to be specifically recognised and separately considered.
Automatic process trips or shutdown valves.
Valves which are activated by process measurement sensor and close automatically on detection of abnormal process or equipment conditions, such as increased pressure or temperature, normal
function as part of a trip or shutdown systems. They can designed with an additional function in mind, IE a role in some circumstances in emergency isolation. However this needs careful consideration, as the valves may need to be capable of providing tight shut-off. Fire proofing may also be necessary to ensure they continue to function in emergency situations.
Remotely operated shut-off valves.
Risks from a major accident hazard can be reduced more effectively by fitting pipework with ROSOVs which can be closed quickly in an emergency. They should be installed if a foreseeable release of a dangerous substance from a section of pipework or associated plant could cause a major accident and consequences could be significantly reduced by rapid isolation. Although ROSOVsare the preferred option other measures can demonstrate that they can give a similar level of protection. ROSOVs may be manually activated through push-buttons located at some distance from the valve. Leak detection may trigger an alarm, usually both on the plant and in the control room, to which the operator can respond by operating the ROSOVs and other systems as necessary.
The advantages of manually activation include:
The valve of an operators assessment regarding the most appropriate measures for dealing
with the leak, including isolation.
Avoidance of spurious trip.
Avoidance of the potential failure of an automatic device.
Manual activation should be justifiable and the location of push-buttons must not endanger the operator. They should be accessible and in a safe and suitable place in relation to the emergency which may occur. There should normally be at least two activation points, one of which should be in the plant area. The control room would normally be the best place. Activation points should be readily indefinable both on plant and in operating instructions. A more immediate response to potential
danger can be providedROSOVswhich can be activated by a detection system (for example, detectors for toxic or flammable gas or smoke, situated around critical plant.)
Advantages of such automatic activation include:
Elimination of potential operator error. More rapid isolation.
Reduction in calculated releases for risk assessment purposes and consequent off-site effects.
Facilities for the manual activation of ROSOVs should be provided as a back-up to automatic
activation, which may result in a faster response in some circumstances, for example , on emergency escape route from plant.
Design consideration for ROSOVs.
Emergency isolation systems should be planned to suit the plant system design and operating practices. ROSOVs may be needed at process vessels, pumps and other ancillary equipment and pipework, taking into account likely points of release such as equipment joints and fittings and rotating equipments for example pump seals. they should be installed as close as possible to the vessel or plant and be accessible for routine testing and maintenance. Generally, valve closure should be as quick as is possible bearing in mind system design limitations.
On complex or interconnecting plant the location or ROSOVsrequires careful considerations due to the potential for 'boxing-in' of inventories. This can lead to, for example, over pressurisation of the pipework at increased temperatures. the possible effects of spurious trips should also be considered. A formal assessment such as a hazard and interoperability study (HAZOP) should consider these
aspects. Generic assessment based on sound site standards for isolation and other mitigation
measures is acceptable. However, it is important to recognise that release scenarios may be specific. ROSOV selection feature.
There are some important features to be considered in selecting an appropriateROSOV. The valves should be:
Be classed as 'safety critical' valves and be subject to appropriate inspection and maintenance
requirements. Regular testing is required, especially where valve operation is infrequent.
Companies should determine the frequency and nature of testing based on design and use. In the absence of this assessment, a minimum of three-monthly intervals is recommended.
Only perform a dual function (IE control and emergency isolation) in special circumstances and
their role in emergency isolation of inventories must be recognised and justified by design.
Employ fail-safe principles. ROSOVs are generally configured to fail closed. Back-up power/air
supplies should be provided if closure on failure of plant systems is not acceptable.
Remain in the fail-safe position once operation until manually reset.
Be protected against external hazards such as fires or explosions, where there major accident
hazard is a fire or explosion risk, for example where the valve could e subject to flame impingement.
1.9 - Mechanical and systems failures to major accidents. Flixborough.
At 4.53 pm on 1st June 1974, there was an explosion at a chemical factory owned by Nypro (UK) Ltd at Flixborough in Lincolnshire. It was equivalent to about 15 tons of TNT; 26 employees were killed and 36 injured. There were 53 reported injuries to people outside the plant and many unreported. Smoke rose to a height of over 6,000 ft (1,800 m) so aircraft had to be diverted; some debris was
found 12 miles (19.3 km) away and many fires were started within a radius of 3 miles. The 60-acre site was devastated, together with over 2,000 houses, factories and shops around the plant.
The plant oxidised cyclohexane which, when heated to 155°C at a pressure of 126 psi (8.8 bar) produced caprolactam, a substance used in the manufacture of nylon. According to the chemical inventory, the plant stored large quantities of benzene, toluene, naptha and gasoline, all of which are very highly flammable materials.
The process consisted of six reactors in series, containing a total of 120 tons of cyclohexane and a small amount of cyclohexanone. The final reactor in the process contained 94 per cent cyclohexane. There was a massive leak followed by a large unconfined vapour cloud explosion and fire. It was estimated that 30 tons of cyclohexane was involved in the explosion. The accident occurred on
Saturday; on a working day, casualties would have been much higher; estimates of five hundred have been put forward.
The chain of six reactors (retorts), each lined with stainless steel, were linked to each other by a 28 inch (711 mm) diameter pipe, and there was a set of bellows at each end of the pipe to allow for expansion. No. 5 retort had developed a 6 ft (1.8 m) crack and in order to take it out of use, a bypass pipe 20 inch (508 mm) in diameter had been fitted between Nos. 4 and 6 retorts. As each retort was 14 inches (350 mm) below the next, a 'dog's hind leg' had to be welded into the pipe; this pipe was fabricated from material on the site and not from the same material as specified by the original manufacturers.
The use of expansion joints (bellows, in this case), which were improperly installed, may have been a principal reason for the accident. This provides additional reasons not to use expansion joints (except in special exceptional circumstances). When re-commissioning the modified plant, it was considered that the working pressure on the pipe and bellows would have been 38 tons; a straight pipe would have withstood this pressure but the dog-leg did not.
During the inquiry, it was observed that the post of Works Manager was vacant and that the other chemical engineers on site were not capable of solving engineering problems. The replacement pipe was not to the standards laid down in British Standards BS 3511:1971; also, the instructions as to how to fit the bellows had not been read. The chemical inventory exceeded the quantities allowed by the licence by 51 times.
Several new metallurgical observations were made during the inquiry. First, that in the presence of zinc, stainless steel can become embrittled and suffers cracking when under heat and stress. Only small quantities of zinc are necessary and they could be found in the galvanised plating on walkways, sheets of galvanised iron and fittings; the zinc need only be near the stainless steel. When nitrates are added to the cooling water, it can cause nitrate stress corrosion in the steel of the reactors. A third observation was that stainless steel can produce creep cavitation when subjected to a small fierce fire, which can cause a fracture in a pipe within a matter of minutes.
Causes of the accident :
The immediate cause was determined as failure of a pipe which was replacing a failed reactor, leading to the release of a large vapour cloud of cyclohexane that ignited.
There were, however, many contributory factors:
(a) The reactor failed without an adequate check on why (metallurgical failure).
(b) The pipe was connected without an adequate check on its strength, and on inadequate supports. (c) Expansion joints (bellows) were used on each end of pipe in a dog-leg without adequate support, contrary to the recommendations of the manufacturer.
(d) There was a large inventory of hot cyclohexane under pressure. (e) The accident occurred during start-up.
(f) The control room was not built with adequate strength, and was poorly sited.
report, "there was no mechanical engineer on site of sufficient qualification, status or authority to deal with complex and novel engineering problems and insist on necessary measures being taken."
(h) The plant did not have a sufficient complement of experienced people, and individuals tended to be overworked and liable to error.
Management deficiencies:
A lack of experienced and qualified people.
Inadequate procedures involving plant modifications.
Regulations on pressure vessels that dealt mainly with steam and air and did not adequately
address hazardous materials.
A process with a very large amount of hot hydrocarbons u nder pressure and well above its flashpoint, installed in an area that could expose many people to a severe hazard.
The cost of this disaster is estimated to have been in the order of £27 million for damage to the factory and £1.6m for the repair of shops and houses, at 1975 prices. It is a typical example of the causes and sub-causes all adding up to a major disaster. By coincidence, very shortly afterwards the Health and Safety at Work Act came into force.
1.10 - Hydrocracker Explosion and Fire, Grangemouth, 22nd March 1987.
Hydrocracking is an exothermic refinery process involving the breakdown of low-grade waxy products and thick viscous oils by subjecting them to hydrogen gas at high temperatures and pressures in the presence of a catalyst to form high-grade light oils, petroleum spirits and liquid petroleum gas (LPG). The hydrocracker unit at the refinery consisted of a series of four fixed-bed vertical reactors, operating in an atmosphere of hydrogen at 155 bar (2250 psig) and 350°C. Waxy distillates were continuously fed through the reactors. The temperatures of the reactor beds were monitored and at 425°C
temperature cut-outs (TCOs) would operate to stop the input of wax feed and hydrogen.
From the reactors, the hydrogenated liquid/gas mixture passed forward through a series of heat exchangers and a fin fan cooler into a vertical high-pressure separator (V305) at a temperature of about 50°C. In V305, the hydrogen and light gases were separated from the liquid and passed to the inlet of centrifugal compressor C301 to be recycled to the reactors. This compressor vibrated at high differential pressures and, although it gave reliable service, it was crucial to the operation of the plant so vibration was closely monitored to prevent breakdown.
Events leading to the incident:
On 13th March, the hydrocracker unit was taken out of service for essential repairs. Late on Saturday 21st March, it was being recommissioned. At the start of the nightshift at 2200 hours, production was steady, but at about 0130 hours on Sunday, alarms sounded in the control room. The plant tripped and a number of pumps and compressors shut down automatically; feed to the reactors was
interrupted and the system started to depressurise. One of the TCOs on V303 had caused the plant trip.
The hydrocracker appeared satisfactory and the TCO was thought to be spurious. No
over-temperature condition was found and the TCO trip was overridden, enabling hydrogen circulation to be re-established. The instrument section verified the reactor temperature control circuits, confirming that they were working. At about 0200 hours, the night shift operators started to bring the plant up to working pressure and to stabilise reactor bed temperatures preparatory to start up. From then until the time of the incident, the plant was being held on standby with no feed coming through. There was nothing of special note in the operation except for a slightly higher than usual vibration from C301.
The incident:
At 0700 hours, there was a violent explosion followed by an intense f ire. The explosion was heard and felt 30 km away. A contractor who had just left the mess room was killed. V306 had disintegrated and large fragments were projected considerable distances.
Difficulties in fighting the fire arose because waxy material from ruptured pipework blocked drains, causing fire water to accumulate. Leaking petroleum spirit spread over a large area of the resultant water surface and five hours after the explosion, it ignited. A number of other process units in the hydrocracker complex were enveloped in flames.
The potential consequences of the incident could have been much greater. It occurred on a Sunday morning when few people were on site.
Investigation by HSE:
Initial fire and explosion evidence suggested there had been an explosive pressure vessel failure involving V306, followed by release of the gas and liquid contents as a cloud or mist. This produced not only a fireball but also blast effects due to the semi-confined nature of the plant.
Operators denied taking action or making adjustments which could explain the incident. However, all the evidence suggested that valve LIC 3-22 had been opened and closed on manual control at least three times after the shift changeover at 0600 hours. Liquid level in V305 fell, and when LIC 3-22 was opened again just prior to the incident, all remaining liquid drained away, allowing high-pressure gas to break through. LIC 3-22 did not close automatically because its trip solenoid was disconnected. The investigation established that the pressure relief valve on V306 was not of sufficient capacity to relieve the maximum potential flow of high-pressure gas to prevent over-pressure. Also, too much reliance was placed on operators for the safe control of flow from high-pressure plant into a low-pressure system. The refinery had procedures for routine monitoring of interlocks, alarms and trips, but on the checklist for the hydrocracker, some were omitted.
Preventative measures that could have been taken to avoid the incident:
(a) V306 should have had a high-integrity automatic safety system to protect against gas
breakthrough and also pressure relief provision to cater for maximum anticipated gas flow rates. The safety shut-off system should have included a secondary shut-off valve in the line from V305, in addition to the control valves. Dual extra-low level detection should also have been fitted on V305 to provide independent shut-off trips.
(b) The trip systems and alarms as installed should nevertheless have been connected and in full operational order. They should have been included in comprehensive testing schedules. Defects should have been reported, recorded and acted upon.
(c) Changes to plant should only have been made after full consideration of the possible safety consequences.
(d) Control room practices should have been monitored to detect possibilities for malpractice or error. Ergonomic factors in the design and layout of controls should have been periodically reassessed. (e) The problem of wax blockages in the level detection system on V305 and the associated small-bore pipework should have been fully analysed. Steps should have been taken to reduce the
likelihood of blockage by, for example, the use of larger-bore pipework and monitored trace heating. The identification of blockages could have been assisted by dual-level detectors and more
sophisticated-level instrumentation.
(f) Wax blockages in the lines could have been prevented by lagging and trace heating. (g) A full analysis of the dangers and potential consequences inherent in the operation of the
hydrocracker should have been carried out and documented. Adequate safeguards should have been provided and all concerned should have been made aware of the potential dangers and necessary
precautions.
1.11 - Piper Alpha.
The Piper Alpha oil platform stood 100 feet above some of the fiercest waters in the North Sea. The accommodation block was designed to hold over 200 men, and gantries held aloft a burning torch, a symbol of the thousands of tons of oil it was pumping back to shore. Occidental Petroleum was getting around £3.5m a day from its operation. At its peak, Piper Alpha accounted for 10% of the UK's North Sea oil production.
But in just a few hours on July 6th, 1988, the rig was reduced to a blackened, smoking stump. Most of it melted and fell into the sea. Of the 224 men on board, 165 died. Two crew members of a rescue boat were also killed. Thirty bodies were never recovered.
The catastrophe shocked the oil industry into realising that the dangers on a rig like Piper Alpha were worse than they had possibly imagined. The public enquiry also made it clear that it was not an
'accident'. They held the Occidental management directly responsible for a series of preventable failings and errors.
Bad communication and organisation of the paperwork allowed a pump to be turned on while it was in the process of being fixed.
The sequence of events was:
A permit had been issued to remove the safety valve on pump A. The jo b was unfinished and a
blanking plate was fixed; the permit was returned to the supervisor but was subsequently lost.
Pump B failed, and the supervisor cancelled a second permit for a maintenance shutdown on
pump A.
The cap on pump A blew, causing a gas explosion. The explosion was, experts say, survivable
for most of the men, apart from the one or two who were probably killed instantly. But there were no blast walls around this area, just fire walls, and so an oil fire quickly took hold. The controls were knocked out and the rig shut down.
Two other rigs feeding into the same oil export line did not shut down until one hour after the
initial mayday, which meant oil from these rigs flowed back towards Piper and fuelled the fire. The fire escalated out of control.
Gas pipelines ended in the area where the oil fire had started. They were eventually ruptured
in the heat and the explosion engulfed the rig in thousands of tons of burning gas.
Occidental had known about this danger; it was highlighted 12 months earlier in a report. But no changes had been made and no protection was given to these vulnerable areas, which were a result of the rig having been converted to pump gas as well as oil.
A nearby rescue vessel was too slow to reach Piper Alpha.
The thick black smoke prevented evacuation by helicopter from the helideck.
Dozens of men were trapped in the accommodation block - the routes to the lifeboats were blocked, and there was no message over the public address system telling them what to do.
The rig was falling to pieces in front of their eyes. Most stayed where they were until smoke and gas fumes overcame them. The only survivors disobeyed all their (minimal) training and jumped 100 feet into the sea.
The rig melted in temperatures of 1,000°C. The only part to survive above water was the drilling platform (supposedly the most high-risk area).
Lord Cullen's report concluded that Occidental had "adopted a superficial attitude" to safety.
One expert on off-shore safety commented, "There is an awful sameness about these incidents. They are nearly always characterised by lack of forethought and lack of analysis, and nearly always the problem comes down to poor management."
The accident was caused by lack of management control in design, procedures, training, communications; all these failures had existed for some time.
1.12 - Explosions And Fire At Allied Colloids - July 1992. Background.
Allied Colloids at Bradford produces various speciality chemicals and is a top-tier major hazard site under the Control of Major Accident Hazards Regulations 1999 (COMAH).
The layout of the raw materials warehouse (RMW) and surrounding area in July 1992 is shown in Figure 'Allied Colloids':
Figure 1. Ground Plan of 'Allied Colloids'.
To the east of the RMW were two external chemical drum storage areas known as X-Bay and J-Bay and the finished goods warehouse. To the south was the 'fire block' where drums of flammable liquids
housing.
In one corner of the RMW were two fire-resisting storerooms known as the oxystores. These had block work walls. The roof consisted of PVC-coated galvanised sheet steel with a 60mm inner glass wool insulation lining. The joint between the block work walls and the underside of the roof was sealed by 1.5 m slabs of a low-density vermiculite-type fire insulation material. Both oxystores had louvered ventilation grilles in the rear wall to provide high and low-level ventilation.
No. 2 oxystore was originally designed for frost-sensitive products so it had a steam heating system consisting of a six metre long radiant panel type heater installed at high level. This was supplied with steam at around 4 bar through a 40 mm line with an isolation valve and a 40 mm solenoid piston valve controlled by a flameproof thermostat mounted on the right-hand door pillar. The condensate return line was in 20 mm pipe and ran along the left-hand wall five metres above floor level, i.e.
corresponding to a pallet load on the top shelf. During heater operation, the temperature of this unlagged pipe was calculated to be 90° +/- 5°C.
Entry to No. 2 oxystore was through two independent roller-shutter doors, giving an aggregate fire resistance of six hours. The doors were designed for forklift truck entry; the inner door was normally left raised, thereby reducing the effective fire resistance to three hours. Neither of the doors had a fusible link closure device to automatically close them in the event of fire.
In the main warehousing area of the RMW, there were a number of steam heater blower units. None of them were located in the oxystores.
The Incident.
On 21st July 1992, No. 2 oxystore contained large amounts of AZDN (azodiisobutyronitrile),
ammonium persulphate (APs) and sodium persulphate (SPs) plus nitrates and some other chemicals. At 9 am, an order was received for four kegs of AZDN and se ven bags of SPS. The warehouseman
fulfilled this order from the stocks in No. 2 oxystore and closed the roller-shutter door.
Earlier it had been raining and the warehouse floor had become wet from movement of lift trucks. An electrician was asked to switch on the steam-heated blower heaters in the RMW. After looking at the control panel, he left, having failed to override the thermostat. Although the contractor for the heating system in No. 2 oxystore was in the same panel, the electrician said he had not touched it.
At around 1.30 pm a lift truck operator noticed 'white smoke ' coming from the lower vent of No. 2 oxystore, and set off the fire alarm. The internal fire team turned out, together with five senior
managers, including the safety manager. A member of the fire team raised the electric roller-shutter door slightly and saw that two or three kegs of AZDN had ruptured, spilling their contents and creating a dust cloud.
After referring to the supplier's hazard datasheet for AZDN, a d ecision was made to use a type H vacuum cleaner for toxic dusts; there was a delay while confirmation was sought from the suppliers by telephone and a vacuum cleaner was obtained. At around 2.10 pm some employees in the office block saw 'white smoke' issuing from the ventilators at the rear of RMW - probably a further AZDN keg had ruptured and dust was leaking out.
Around 2.15 pm the shift chemist looked into the store t hrough the roller-shutter door and heard a loud hissing noise. A plume of smoke or vapour was coming from a bag of SPS located below the split
by a flash and an explosion. An intense fire broke out in the storeroom, with thick black smoke. The fire spread rapidly to the remainder of the warehouse and external chemical drum storage.
None of the company employees were injured but 33 people, including three residents and 30 fire or police officers were taken to hospital, primarily for smoke inhalation. 2,000 local residents were confined to their houses and residents in eight properties immediately adjacent to the raw materials warehouse were evacuated. Fire water run-off caused significant river pollution.
The fire service finally stood down 18 days later, because of the on-going risk of re-ignition during the cleaning-up operations.
HSE Investigation.
The oxystores were not being used solely for their original purpose. No. 1 oxystore contained not only organic peroxides (which possess oxidising properties and can undergo violent decomposition) but also VAZO 67, a flammable solid with similar properties to AZDN. No. 2 oxystore contained nearly 21 tons of persulphates, which are oxidising agents, stored together with 1.9 tons of AZDN, which is thermally unstable and can undergo violent decomposition at relatively low temperatures (the self-accelerating decomposition temperature for a 25 kg package is 50°C). It is a flammable solid, and the ignition of a dispersion of the dust in air can result in an explosion. AZDN (and other flammable solids) and oxidising agents such as persulphates are incompatible and should not be stored together.
Despite the original intention that X-Bay was intended for non-flammable materials, in practice it contained a large quantity of combustible materials in drums.
The incident started when two or three kegs of AZDN ruptured. These were stored on the top shelf of the racking, close to the steam condensate return line. A malfunction of the steam heating system or operator error probably caused the condensate pipe to be hot.
If the AZDN had been stored separately from oxidising substances, it is unlikely that the incident would have developed further. Powder from the ruptured kegs was scattered over the lower shelves. Knives were used for quality control sampling and for removing outer shrink wrapping from bags of oxidising substances; persulphate may have spilled from inadequately resealed or accidentally-cut bags. AZDN in contact with persulphate is likely to have been ignited by impact, possibly from a lid from one of the damaged AZDN kegs falling onto a bag, or to the floor. A keg lid falling from the top shelf would create sufficient impact energy in theory to ignite the mixture.
After the ignition, there was probably a small dust explosion followed by a second, larger dust
explosion. The roof was lifted and the fire transferred quickly to No. 1 oxystore where organic peroxide was stored with VAZO 67. This generated an extremely intense fire which rapidly spread, assisted by the open outer door of oxystore No. 2, the lack of a closure device on the inner roller-shutter door, and mixed dusts on ledges and wall tops that may have ignited, causing a linear spread of flame. No fire protection sprinklers were provided.
Examination of the oxystore blockwork walls after the fire showed they had not been fully keyed into the building support pillars; in one place adjoining X-Bay, a sizeable area of infill wall section had fallen out. This and the presence of stored chemicals against the warehouse wall added to the rapid spread to X-Bay.
Most of the materials on J-Bay were of low combustibility but a parked lorry loaded with n-butyl
acetate (highly flammable) was ignited at an early stage which contributed to the fire spread to J-Bay. The main mechanism of fire spread was direct ignition, assisted by the strong wind and radiated heat.
and augmented by material from X and J-Bays, which flowed downhill towards the centre of the site. Conclusions.
(a) The crucial error was the incorrect categorisation of AZDN and its storage with oxidising agents with which it was chemically incompatible. The same mistake was made with VAZO 67. Although a written segregation policy for packaged chemicals existed, there was no record or plan of where chemicals with particular hazardous properties were stored. There was also a failure to implement HSE advice published in 1986, The storage of packaged dangerous substances, which contained guidance resulting from investigations of other major warehouse fires.
(b) The identity of the logistics department was unrecognised in corporate policies. Job descriptions in the department were incomplete and outdated, so it was impossible to appraise the performance of individual managers against them. The department was treated as a Cinderella in terms of health and safety resources for improvements.
No system existed for monitoring safety performance in the logistics department, despite a general recognition that there were serious deficiencies in safety standards throughout the raw materials storage areas. Targets were not set for improved safety performance nor were action plans drawn up for health and safety improvements despite the recommendations of highly critical insurance company reports.
(c) Steam heating pipes and panels in No. 2 oxystore were not effectively isolated from the steam supply after the main purpose of the storeroom was changed from frost-sensitive flammable products. Positive action to provide suitable protected electrical equipment, temperature monitoring equipment and smoke detectors had not been taken.
(d) Flawed as it was, the segregation policy for chemicals was not effectively implemented.
-Warehouse staff was unaware of the policy, and training and instruction did not cover the segregation of the incompatible chemicals.
(e) 50 minutes elapsed after the initial rupturing of AZDN kegs, before the emergency services were called. Although companies need their own facilities for dealing with minor incidents, spillages and leaks, it is important that if there is a risk of the incident getting out of hand, the emergency services are called without delay.
(f) Allied Colloids had a siren, but there were delays in its sounding which meant that members of the public were not alerted to the risk as soon as they could have been. The question also arose as to who should sound the siren; the emergency services took charge of managing the emergency but they did not have the authority to order the sounding of the siren. The siren operated for about 50 minutes, until power to the site was cut off.
(g) During and after the fire, there was considerable debate about the toxicity of the smoke, and a lack of accurate advice for residents, farmers and others directly affected.
(h) Tens of millions of litres of water were needed to extinguish the fire, and this mixed with chemicals released from ruptured containers. Most of the contaminated run-off found its way into water courses causing serious environmental effects.
consequent congestion of the site, together with the danger of escalation if the fire had spread to production facilities and chemical storage areas.
1.13 - Fire At Hickson & Welch - September 1992.
Hickson & Welch in Castleford, West Yorkshire manufactures organic chemicals. Nitrotoluene
production is carried out in one area of the site, in plants called Meissner I and II, which face a control building and the main office block.
At the time of the incident a process vessel known as '60 still base', used to distil an organ ic liquid in batches, was being raked out to remove an accumulation of semi-solid sludge (see Figure 12.4):
Figure 1. 60 Still Base.
Before raking, heat was applied for about three hours to the residues through an internal steam coil. This started an exothermic runaway reaction in the sludge leading to deflagration and a jet flame. The flame cut through the nearby control building, killing two people immediately and fatally injuring two more. It then struck the four-storey office block, shattering windows and setting rooms on fire. All the employees in this building managed to escape except for one, who was overcome by smoke in a second floor toilet; she died later.
The HSE drew the following conclusions from this investigation:
plant. Materials processed in the vessel were known to be highly energetic but no attempt was made to monitor residue accumulation. The view of the management was that the level of residue in the still base ebbed and flowed with successive distillations. On 21st September 1992, the Area Manager (AM) authorised removal of sludge from 60 still base without any attempt to identify this material or the hazards involved. The residue contained organic nitro-compounds; it is well-known that these can undergo exothermic decomposition at elevated temperatur es, leading to thermal runaway.
Several days before the accident, 60 still base was used to vacuum out a thick residue from
two whizzer oil storages. This operation was not authorised at an appropriate level by
management. Transfer of material from the still base into a waste tank proved difficult after the vacuuming operation, which was then followed by two batch distillations that were completed by 20 September.
60 still base had not been opened for cleaning in the previous 30 years and operating
procedures for the plant were old. They had not been revised following a process change in 1988, and they made no reference to maintenance and clean-out. Formal cleaning procedures requiring water jetting were available for other still bases used at the factory.
Preparatory work for removal of residue from 60 still base was authorised by newly-designated
team leaders following a brief discussion with their AM. He authorised application of heat through the bottom steam battery without previously checking that the temperature of this residue could be monitored. He assumed that the still base thermometer probe would record its temperature but was not aware of the limitations of this system for that purpose. The issue of permits for the activities that followed involved a team leader who had recently been
relocated back to the Meissner plant. He had not received refresher training but was allowed to authorise removal of the still base manlid and the fitting of a blanking plate using the
company's permit-to-work procedure. The permits issued were not checked by the AM and a permit was not issued to cover the use of a metal tool for the raking out operation. Other elementary mistakes were made. The atmosphere inside the still base was not tested for flammable vapour and the sludge was not sampled and analysed. The fatal mistake was the application of heat through the bottom steam battery. The hazards were not assessed and the job was not planned. The AM was dealing with several other problems which required his
attention, and one of his manufacturing controllers was on holiday. The newly- appointed team leaders therefore assumed most of the responsibility for the task.
The Meissner control building housed lockers, showers, offices and some control equipment.
Its lightweight structure offered no protection from the heat and blast of the fire. Formal
assessment of the risks to the building and those who used it from surrounding plant had never been carried out, and the possibility of exposure to a jet fire had not been foreseen. A limited amount of technical guidance is available to industry on this subject and can be used to form the basis for assessment of control building design and location.
Examination of the means of escape from the main office building revealed breaches in the
fire-resisting structure of a protected route on the second floor. These breaches above a false ceiling led to smoke-logging of the means of escape and probably caused smoke-logging in an adjacent toilet. Inspection following alterations, and regular monitoring of performance
standards prescribed in the firm's fire certificate, should have been carried out to ensure that the integrity of escape routes was maintained. Furthermore, although the company had formal procedures to provide and record 'fire training' (required by their fire certificate) there was no written confirmation that the fifth fatality of a temporary office worker had been trained.
In the confusion following the incident, and because many staff were absent for lunch, there
were problems with carrying out roll calls at designated locations. Within 10 minutes of evacuating the office block, it was established that someone was missing. The fire officers entered the building with no idea of the casualty's likely location.
1.14 - Video: Buncefield. http://www.sheilds-elearning.co.uk/file.php/4/videos/Buncefielld.flv
1.15 - Icmesa chemical company, Seveso, Italy. 10th July 1976. Accident summary.
The industrial plant was owned by the company ICMESA (Industrie Chimiche Meda Società
Azionaria), a subsidiary of Givaudan which in turn was a subsidiary of Hoffmann-La Ro che (Roche Group). The f actory building had been built many years earlier and it was not viewed by the local population as a potential source of danger.
At approximately 12:37 on Saturday 10th July 1976, a bursting disc on a chemical reactor ruptured. Maintenance staff heard a whistling sound and a cloud of vapour was seen to issue from a vent on the roof. A dense white cloud of considerable altitude drifted offsite. The release lasted for some twenty minutes. About an hour after the release, the operators were able to admit cooling water to the reactor.
Among the substances of the white cloud released was a small deposit of 2,3,7,8-tetrachlorodibenzo-p-dioxin (TCDD), a highly toxic material. The nearby town of Seveso, located 15 miles from Milan, had some 17,000 inhabitants.
Over the next few days following the release, there was much confusion due to the lack of communication between the company and the authorities in dealing with this type of situation.
No human deaths were attributed to TCDD but many individuals fell ill. A number of pregnant women who had been exposed to the release had abortions. In the contaminated area, many animals died. Failings in technical measures:
The production cycle was interrupted, without any agitation or cooling, allowing a prolonged
holding of the reaction mass. Also, the conduct of the final batch involved a series of failures to adhere to the operating procedures. The original method of distillation patent specified that the charge was acidified before distillation. However, in the plant procedures, the order of these steps was reversed.
Operating Procedures: Safe operating procedures.
The bursting disc was set at 3.5 bar, and was to guard against excessive pressure in the
compressed air that was used to transfer the materials to the reactor. Had a bursting disc with a lower set pressure been installed, venting would have occurred at a lower and less
hazardous temperature.
Relief Systems / Vent Systems: Venting of excessive pressures, sizing of vents for exothermic
reactions
The reactor control systems were inadequate both in terms of the measuring equipment for a
number of fundamental parameters and also in the absence of any automatic control system.
Control Systems: Sensors.
Alarms / Trips / Interlocks: Loss of cooling, agitator failure.
The company was aware of the hazardous characteristics of the principal exotherm. However,
studies showed that weaker exotherms existed that could lead to a runaway reaction.
Reaction / Product Testing: Calorimetry methods, thermal stability.
There was no device to collect or destroy the toxic materials as they vented. The manufacturer
of the bursting disc recommended the use of a second receiver to recover toxic materials. No such vessel was fitted.
Design Codes - Plant: Nature of hazardous releases. Secondary Containment: Catchpots.
Information on the chemicals released and their associated hazards was not available from the
company. Communication was poor and failed both between the company and the local authorities and within the regulatory authorities.
On 9th December 1996, the EU passed Council Directive 96/82/EC on the control of major-accident hazards involving dangerous substances (as amended). This is a European Union law aimed at improving the safety of sites containing large quantities of dangerous substances. It is also known as the Seveso II Directive, after the Seveso disaster
References.
Lees, F.P., 'Loss Prevention in the Process Industries - Hazard Identification, Assessment and Control', Volume 3, Appendix 3, Butterworth Heinemann, ISBN 0 7506 1547 8, 1996.
1.16 - Chernobyl - 26th April 1986. Chernobyl Accident:
The Chernobyl accident in 1986 was the result of a flawed reactor design that was operated
with inadequately trained personnel and without proper regard for safety.
The resulting steam explosion and fire released at least five percent of the radioactive reactor
core into the atmosphere and downwind.
28 people died within four months from radiation or thermal burns, 19 have subsequently died,
and there have been around nine deaths from thyroid cancer apparently due to the accident: total 56 fatalities as of 2004.
An authoritative UN report in 2000 concluded that there is no scientific evidence of any
significant radiation-related health effects to most people exposed. This was confirmed in a very thorough 2005-06 study.
The April 1986 disaster at the Chernobyl nuclear power plant in the Ukraine was the product of a
flawed Soviet reactor design coupled with serious mistakes made by the plant operators in the context of a system where training was minimal. It was a direct consequence of Cold War isolation and the resulting lack of any safety culture.
Figure 2. Reactor Diagram. Reactor diagram.
The accident destroyed the Chernobyl-4 reactor and killed 30 people, including 28 from radiation exposure. A further 209 on site and involved with the clean-up were treated for acute radiation poisoning and among these, 134 cases were confirmed (all of whom apparently recovered).
Nevertheless 19 of these subsequently died from effects attributable to the accident. Nobody off-site suffered from acute radiation effects. However, large areas of Belarus, Ukraine, Russia and beyond were contaminated in varying degrees.
The Chernobyl disaster was a unique event and the only accident in the history of commercial nuclear power where radiation-related fatalities occurred.* However, its relevance to the rest of the nuclear industry outside the then Eastern Bloc is minimal.
*There have been fatalities in military and research reactor contexts, e.g. Tokai-mura. The accident.
On 25th April, prior to a routine shut-down, the reactor crew at Chernobyl-4 began preparing for a test to determine how long turbines would spin and supply power following a loss of main electrical power supply. Similar tests had already been carried out at Chernobyl and other plants, despite the fact that these reactors were known to be very unstable at low power settings.
A series of operator actions, including the disabling of automatic shutdown mecha nisms, preceded the attempted test early on 26th April. As flow of coolant water diminished, power output increased. When the operator moved to shut down the reactor from its unstable condition arising from previous errors, a peculiarity of the design caused a dramatic power surge.
The fuel elements ruptured and the resultant explosive force of steam lifted off the cover plate of the reactor, releasing fission products to the atmosphere. A second explosion threw out fragments of
burning fuel and graphite from the core and allowed air to rush in, causing the graphite moderator to burst into flames.
There is some dispute among experts about the character of this second explosion. The graphite -there was over 1200 tons of it - burned for nine days, causing the main release of radioactivity into the environment. A total of about 14 EBq (1018 Bq) of radioactivity was released, half of it being
biologically-inert noble gases.
Some 5000 tons of boron, dolomite, sand, clay and lead were dropped on to the burning core by helicopter in an effort to extinguish the blaze and limit the release of radioactive particles.
Figure 3. The Damaged Chernobyl Unit 4 Reactor Building. Immediate impact.
It is estimated that all of the xenon gas, about half of the iodine and caesium and at least 5% of the remaining radioactive material in the Chernobyl-4 reactor core (which had 192 tons of fuel) was released in the accident. Most of the released material was deposited close by as dust and debris , but the lighter material was carried by wind over the Ukraine, Belarus, Russia and to some extent over Scandinavia and Europe.
The main casualties were among the firefighters, including those who attended the initial small fires on the roof of the turbine building. All these were put out in a few hours, but radiation doses on the first day were estimated to range up to 20,000 millisieverts (mSv), causing 28 deaths in the next four months and 19 subsequently.
The next task was cleaning up the radioactivity at the site so that the remaining three reactors could be restarted, and the damaged reactor shielded more permanently. About 200,000 people
("liquidators") from all over the Soviet Union were involved in the recovery and clean up during 1986 and 1987. They received high doses of radiation, on average around 100 millisieverts. Some 20,000 of them received about 250 mSv and a few received 500 mSv. Later, the number of liquidators
swelled to over 600,000 but most of these received only low radiation doses. The highest doses were received by about 1000 emergency workers and on-site personnel during the first day of the accident. Initial radiation exposure in contaminated areas was due to short-lived iodine-131; later caesium-137 was the main hazard. (Both are fission products dispersed from the reactor core, with half lives of 8 days and 30 years respectively. 1.8 Ebq of I-131 & 0.085 Ebq of Cs-137 were released.) About five million people lived in areas contaminated (above 37 kBq/m2 Cs-137) and about 400,000 lived in more contaminated areas of strict control by authorities (above 555 kBq/m2 Cs-137).
On 2nd-3rd May, some 45,000 residents were evacuated from within a 10 km radius of the plant, notably from the plant operators' town of Pripyat. On 4th May, all those living within a 30 kilometre radius - a further 116 000 people from the more contaminated area - were evacuated and later
relocated. About 1,000 of these have since returned unofficially to live within the contaminated zone. Most of those evacuated received radiation doses of less than 50 mSv, although a few received 100 mSv or more.
Reliable information about the accident and resulting contamination was not available to affected people for about two years following the accident. This led to distrust and confusion about health effects.
In the years following the accident, a further 210,000 people were resettled into less contaminated areas, and the initial 30 km radius exclusion zone (2,800 km2) was modified and extended to cover 4,300 square kilometres. This resettlement was due to application of a criterion of 350 mSv projected lifetime radiation dose, though in fact radiation in most of the affected area (apart from half a square kilometre) fell rapidly so that average doses were less than 50% above normal background of 2.5 mSv/yr.
1.17 - Three Mile Island. Three Mile Island, 1979:
In 1979, a cooling malfunction caused part of the core to melt in the number 2 reactor at Three
Mile Island in USA. The reactor was destroyed.
Some radioactive gas was released a couple of days after the accident, but not enough to
cause any dose above background levels to local residents.
There were no injuries or adverse health effects from the accident.
The Three Mile Island power station is near Harrisburg, Pennsylvania in USA. It had two pressurised water reactors. One PWR was of 800 MWe and entered service in 1974. It remains one of the best-performing units in USA. Unit 2 was of 900 MWe and almost brand new.
The accident to unit 2 happened at 4 am on 28th March 1979 when the reactor was operating at 97% power. It involved a relatively minor malfunction in the secondary cooling circuit which caused the temperature in the primary coolant to rise. This in turn caused the reactor to shut down automatically. Shutdown took about one second. At this point a relief valve failed to close, but instrumentation did not reveal the fact, and so much of the primary
coolant drained away that the residual decay heat in the reactor core was not removed. The core suffered severe damage as a result.
The operators were unable to diagnose or respond properly to the unplanned automatic shutdown of the reactor. Deficient control room instrumentation and inadequate emergency response training proved to be root causes of the accident
The chain of events.
Within seconds of the shutdown, the pilot-operated relief valve (PORV) on the reactor cooling system opened, as it was supposed to. About 10 seconds later, it should have closed. However, it remained open, leaking vital reactor coolant water to the reactor coolant drain tank. The operators believed the relief valve had shut because instruments showed them that a "close" signal was sent to the valve. However, they did not have an instrument indicating the valve's actual position.
Responding to the loss of cooling water, high-pressure injection pumps automatically pushed replacement water into the reactor system. As water and steam escaped through the relief valve, cooling water surged into the pressuriser, raising the water level in it. (The pressuriser is a tank which is part of the primary reactor cooling system, maintaining proper pressure in the system. The relief valve is located on the pressuriser. In a PWR like TMI-2, water in the primary cooling system around the core is kept under very high pressure to keep it from boiling.)
Operators responded by reducing the flow of replacement water. Their training told them that the pressuriser water level was the only dependable indication of the amount of cooling water in the
system. Because the pressuriser level was increasing, they thought the reactor system was too full of water. Their training told them to do all they could to keep the pressuriser from filling with water. If it filled, they could not control pressure in the cooling system and it might rupture.
Steam then formed in the reactor primary cooling system. Pumping a mixture of steam and water caused the reactor cooling pumps to vibrate. Because the severe vibrations could have damaged the pumps and made them unusable, operators shut down the pumps. This ended forced cooling of the reactor core. (The operators still believed the system was nearly full of water because the pressuriser level remained high.) However, as reactor coolant water boiled away, the reactor's fuel core was uncovered and became even hotter. The fuel rods were damaged and released radioactive material into the cooling water.
At 6:22 am, operators closed a block valve between the re lief valve and the pressuriser. This action stopped the loss of coolant water through the relief valve. However, superheated steam and gases blocked the flow of water through the core cooling system.
